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^katbnNo. 10/061,435 
Amnot-dated: December 22, 2004 

to (XRce Action maTed: Septsn^ 28, 2004 

Amendments to the SnerifiraKpTIi 

Please replace the patagraph beginning at page 5, line 15, with the following rewritten 
paragraph: 

On Page 1, change the paragraph following the heading "RELATED APPUCAnONS" to read a 
follows: 

- - This is a oontinuation-in-patt of U.S. Patent Application Serial No. 09/209,635 

filed on December 10, 1998 entitled "ERROR SELI^HBCKING AND RECOVERY USING LOCK- 
STB> PROCBSOR PAIR ARCHrrKTUR& ", fPatent No. 6.:^Q^.582 issued Mav J1 ^np ?), the 
disdosure of whidi Is incorporated her^n by reference as If explldtly set forth.- - 

On page 10, change the paragraph beginning at line 12 to read as follows: 

- -In prindi^e, the detection of divergence need only be detected at opne point, that is, where 
the data leaves the teeaKJogisiLprocessor 10 at the PCI to SAN i/o bridge 24. That is, the 
processor could be designed with full redundancy, including two copies of main memory, and 
the results could be compared at only one point - where the data leaves the processor 10 and 
is placed on the SAN. However, to reduce the cost of the design and to reduce the latency 

error detection, a single copy of main memory is provided. For this configuration, it Is desirable 
to check any data that the master processor 12 writes to the memory 20 before It is written, 
because once written, we have lost the ''second opinion" - there will be no other immediate 
opportunity to detect the error. - 

On page 24, change the paragraph beginning at line 1 to read as follows: 

- - 15.8 Any [oxxsss or Intermpt process that were -was s usnaitten due to SAN 
services FRIP being invoked are-fe.alk>wed to run and normal operation resumes.- - 

On page 26, tJiange the paragraph beginning at line 11 to read as fdtows: 
- -There are two types of inquiry messages. The first Is not unlike a ping, and is used initially to 
determine if a resource is available "me second type of inqulr/ message is used as a query 
wrt^en a message packet has not been acknowledged. Instead of retrying the message or 
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packet, an inquiry message that includes data and a special transaction ID is sent. No retries of 
the original message or pad^ are attemptjed until the Inquiiv message Is r^med. If an 
inquiry message is lost (i.e. times out with no response), the system (I.e, the cluster) will first 
elevate the *error" to a higher level of severity and may in fact marl^ the target as down and 
remove it as a resource to the system. This is not desirable in the invention, where an attemp* 
is being made t o recover in a controlled manner that will enable the processor to continue to | 
function as if the error had not occun^ed.- - 

On page 27, change the paragraph beginning on line 13 to read as follows: | 

- -The implementaljOT of the double IrKjuiry message solution may depend on the type of 
inquiry message used. For example, die SAN protocoi provides few three types of inquiry 
messages - dient inquiry messages, pre-inquiry messages, and eror recovery inquiry 
messages. Qient inquiry merges are used for discovwy purposes. For example, "^sniffers" 
used by the system to checic for viable paths. As it less critical if a client inquiry message is lost, 
the current implementation does not alter the one inquiry message implementation for client 
inquiry messages, although a two client Inquiry m^sage system [Itell may be implemented. 
Pre-inqufry messages are used Ute]] when verifying a particular path before it is used. For pre- 
inquiry messages, two inquiry messages are used, each with a 20 ms timeout En^or recovery 
inquiry messages are used for verification before client data is resent, and are discussed above 
with reference to Rg. 3. FOr error recovery inquiry messages, two inquiry messages are used, 
each with a 20 ms timeout (i.e. 20 ms packet timeout and 20 ms inquiry message timeout).- - 

On page 27, change the paragraph beginning on line 25 to read as follows: j 

- - The inquiry message method executed by tfie network resource 25 is shown in Fig. 4. Rrstiy, 
a data message is sent 100 to the logical processor 10. The logical processor 10 is currentiy 
executing a recovery procedure as described above. If a response is not received 102 from the 
logkal processor 10 before the expiry of the first timeout period X (see Fig. 3), a first inquiry 
message is sent 104. As the logical processor 10 is still conducting the error recovery procedure 
(see Fig. 3), the inquiry message is lost. If the network resource 25 does not receive 106 a 
respor^ by the second timeout period Y (see Fig. 3), a second inquiry message is sent 406108- 
As discussed above, tiie sum of the two timeout periods X and Y is selected to be longer than 
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the expected recovery period Z for die logical processor 10. Accordingly, If the failure of the 
logical processor to respond to the data message is as a result of conducting the eiror recovery 
procedure discussed above, the second inquiry message will be received 110 and the original 
data message will be resent. I however, no response is received after a third timeout period, 
the feilure of the logical processor 10 is deemed to be for another reason, and the error is 
reported to a SAN administratxw njndion for handling. For example, the SAN administrator 
function may remove the logical processor as a network resource, or elevate the error status of 
ttie resource to a higher level.- - 
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